CCISAgov

Products

Exploited and recent CVEs

• CVE-2026-19671 Medium 6.5 Improper handling of highly compressed data (data amplification) in CISA Malcolm 0.4%
• CVE-2026-19670 Medium 5.4 Incorrect Authorization in CISA Malcolm 0.2%
• CVE-2026-63177 High 7.1 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC 0.4%
• CVE-2026-63134 Medium 5.4 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation 0.4%
• CVE-2026-63133 Medium 6.5 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) 0.5%
• CVE-2026-55676 High 8.8 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component 0.6%